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To all whom it may concern: 

Be it known that, Barry Hannigan 
has invented certain new and useful improvements in 

REAL TIME CALL TRACE CAPABLE OF USE WITH MULTIPLE ELEMENTS 
of which the following is a full, clear and exact description: 
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REAL TIME CALL TRACE CAPABLE OF USE WITH MULTIPLE 
ELEMENTS 

PRIORITY 

5 [0001] This application claims priority to the provisional U.S. patent 

application entitled. Real Time Call Trace Capable of Use with Mtdtiple 
Elements, filed December 12, 2000, having a serial number 60/254,839, the 
disclosure of which is hereby incorporated by reference. 

10 FIELD OF THE INVENTION 

[0002] The present invention relates generally to load sharing of a 
telephone system. More particularly, the present invention relates to call tracing 
on a load sharing telephone system. 

15 BACKGROUND OF THE INVENTION 

[0003] Links in a telephone networking system, such as an SS7 network, 
work by load sharing, i.e. each link takes up a known percentage of the total load. 
Within each link, there are generally five sequences that provide 
identification/routing information about a signaling message being transmitted 

2 0 over the network. In other words, five messages are used to set-up and release 
trunk circuits in a service switching point (SSP), namely: Initial address message 
(lAM), address complete message (ACM), answer message (ANM), release 
message (REL), and release complete message (RLC). These five sequences or 
messages make up phone call recognition, as generally known in the area of SS7 

2 5 networks and the like. 

[0004] An SS7 network is more formally referred to as a Common 
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Channel Signaling System No. 7 (i.e., SS7 or C7), which is a global standard for 
telecommunications defined by the International Telecommunication Union (ITU) 
Telecommunication Standardization Sector (ITU-T). The standard defines the 
procedures and protocol by which network elements in the public switched 
telephone network (PSTN) exchange information over a digital signaling network 
to effect wireless (ceUular) and wireline call setup, routing and control. The ITU 
definition of SS7 allows for national variants such as the American National 
Standards Institute (ANSI) and Bell Communications Research (Telcordia 
Technologies) stand^ds used in North America and the European 
Telecommunications Standards Institute (ETSI) standard used in Europe. The 
SS7 and C7 standards hsted above are incorporated herein by reference in their 
entirety. 

[0005] The SS7 network and protocol are used for: basic call setup, 
management, and tear down; wireless services such as personal commimications 
services (PCS), wireless roaming, and mobile subscriber authentication; local 
number portability (LNP); toll-fi-ee (800/888) and toll (900) wireline services; 
enhanced call features such as call forwarding, calling party name/number 
display, and three-way calling; and efficient and secure worldwide 
telecommunications. 

[0006] When a network supervisor wishes to investigate a telephony 
network interruption or delay, he or she will generally resort to an element 
manager to perform a "call trace." The element manager or managers may be 
employed as watchdogs in a telephony system, and the term "call trace" refers to 
the task of understanding how one connection is made to another within the 
network channels. 

[0007] When an lAM message is detected on one link, the processor. 
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sometimes referred to as a probe, detecting the lAM message must send a trigger 
message to other probes monitoring other links because other signaUng messages, 
ACM, ANM, REL, and RLC messages, may take other link paths due to the load 
sharing on the SS7 network. After the JAM message containing one of the codes 
- origination point code (OPC), destination point code (DPC), or circuit 
identification code (CIC)) - has been identified in a given link set (i.e., all links 
between, for example, a given SSP and a given STP, see Fig. 2), there is a fixed 
amount of time to alert all the probes monitoring the network links that fiirther 
messages related to the phone call are likely to be passing imminently. When 
sending the trigger between monitoring processors via a TCP/IP system, there is 
a possibility that bottlenecks inherent in the TCP/IP system will cause the trigger 
to be delayed between the processors. Thus, the ACM message, which follows 
the lAM message by 100msec typically, may go imdetected by the probes. 

[0008] Thus, monitoring link sets for messages containing a selected code 
related to a phone call on a link set can be difficult, if not impossible, particularly 
when multiple link sets must be monitored and/or viewed by an operator. 
Furthermore, in present systems, the only way to determine the order of various 
transmissions is to gather signal information firom the signaling messages, store 
the information in a database, and sort through the stored information for 
purposes of troubleshooting. This process, of course, does not lend itself to real- 
time call tracing. 

[0009] Sophisticated telephone network systems have been disclosed and 
include various mechanisms for troubleshooting inevitable errors, which occur 
during operation. For example, U.S. Patent No. 6,125,177 to Whittaker shows a 
method and an apparatus for enhancing signaHng and call routing between local 
and remote terminals of a telecommunications network defined by a layered 
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hierarchy of protocols and switching between telephony and Internet services. 

[0010] U.S. Patent No. 5,592,530 to Brockman shows a general testing 
and monitoring sj^tem using an SS7 network in the operation of a phone system. 
This reference deals with problems of having data located at two different nodes 
and provides a link monitoring system located at STP sites. 

[0011] U.S. Patent No. 4,959,849 to Bhusri relates to a method and 
architecture for surveillance of network systems, which permits quality control 
for the network system utilizing information within message signal imits received 
by processing elements. U.S. Patent No. 6,104,801 to Miloslavsky relates 
to a system for call routing telephony where routing protocols are associated with 
specific levels of one or more system characteristics. Appropriate routing 
protocols are selected and executed based upon system condition and 
performance. 

SUMMARY OF THE INVENTION 
[0012] The present invention relates to a monitoring system for a 
telephony network, such as an SS7 network, that supports real-time call tracing. 
The monitoring system includes a multi-element manager configuration 
monitoring telephony nodes in mated relationship to one another. Within the 
monitoring system, a trigger is issued by a probe detecting an lAM message 
having a phone number that matches specified criteria. The probe applies a time 
stamp, corresponding to the time the lAM message was asserted onto the 
telephony network link, to the trigger to allow element managers and monitoring 
probes distributed about the telephony system to capture messages stored in local, 
respective buffers and compare the time stamp in the captured messages to the 
time stamp in the trigger. 
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[0013] The time stamp also allows probes monitoring signaling messages 
traveling along telephony network links to: (i) temporarily store all messages in 
a message buffer, (ii) filter the messages in the buffer to determine which 
message(s), if any, meet a given signaling information and/or time stamp criteria, 
and (iii) forward messages, meeting the criteria, to element managers supervising 
the probes. The time stamp and message buffer combination relaxes the high 
speed trigger distribution requirement, which is 100msec, since the determination 
of whether a signaling message is related to a call beyond the 100msec 
requirement at about which an ANM is issued in response to the lAM message. 
Therefore, call tracing can span multiple element managers. The element 
manager, having the messages meeting the criteria, then displays the results to an 
operator in a real-time or pseudo-real-time manner. Alternatively, a remote 
monitoring station in commimication with the monitoring S3^tem can be used to 
display the call tracing information. 

[0014] There has thus been outlined, rather broadly, the more important 
features of the invention in order that the detailed description thereof that follows 
may be better understood, and in order that the present contribution to the art may 
be better appreciated. There are, of course, additional features of the invention 
that will be described below and which will form the subject matter of the claims 
appended hereto. 

[0015] In this respect, before explaining at least one embodiment of the 
invention in detail, it is to be understood that the invention is not limited in its 
application to the details of construction and to the arrangements of the 
components set forth in the following description or illustrated in the drawings. 
The invention is capable of other embodiments and of being practiced and carried 
out in various ways. Also, it is to be xmderstood that the phraseology and 
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terminology employed herein, as well as the abstract, are for the purpose of 
description and should not be regarded as limiting. 

[0016] As such, those skilled in the art wiU ^preciate that the conception 
upon which this disclosure is based may readily be utilized as a basis for the 
designing of other structures, methods and systems for carrying out the several 
purposes of the present invention. It is important, therefore, that the claims be 
regarded as including such equivalent constructions insofar as they do not depart 
from the spirit and scope of the present invention. 

BRIEF DESCRIPTION OF THE DRAWINGS 

[0017] Figure 1 is a diagram of two nodes in a typical real time call trace 
system with combined link sets; 

[0018] Figure 2 is a diagram showing typical SS7 signaling points; 

[0019] Figure 3 is a diagram showing SS7 signaling link types; 

[0020] Figure 4 is a diagram showing an embodiment of interconnections 
of element managers and probes to an SS7 link set; and 

[0021] Figure 5 A - 5C is a flow diagram of an embodiment of a process 
executed within the context of the network devices of Figure 4. 

DETAILED DESCRIPTION OF PREFERRED 
EMBODIMENTS OF THE INVENTION 
[0022] A description of preferred embodiments of the invention follows. 
[0023] With the ever-increasing use of the Internet in residential and 
small business environments comes the increasing use of dial-up access. Dial-up 
Internet access is (i) creating new challenges for public network providers as a 
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result of increased call holding times, and (ii) creating an inability of network 
subscribers to have the capability to accept and trace telephone calls. 

[0024] Although not meant to be limiting, preferably the call tracing 
processor is a general purpose computer running a suitable operating system. The 
principles of the present invention are preferably implemented in software 
supported on the call trace processor and are useful, for example, where the 
following conditions are met: 

1. For each call to be traced, relevant information (for example, 
called number, calling number, additional caller-entered digits if any) about the 
call can be made available by the network to the processor quickly enough to be 
used in deciding call tracing; and 

2 . The monitoring system is capable of receiving commands from the 
processor to direct the trace of the call. 

[0025] In accordance with the principles of the present invention, an 
operator investigating why a phone call is problematic uses a given element 
manager m the monitoring system to perform the investigation. Under the 
auspices of the given element manager, a trigger message issued by a probe 
detecting a phone number criteria entered by the operator is time stamped by the 
probe detecting the trigger message and broadcast by the probe to its respective 
element manager. The respective element manager broadcasts the trigger with 
time stamp to other element managers, which, in turn, send the trigger with the 
time stamp to respective probes. With the time stamp, each probe knows how 
much time has elapsed since the message was put onto the link on which the 
detecting probe monitors. Each probe within the network can then examine 
messages that arrived before the trigger time stamp. The time stamp, being 
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incorporated in or associated with a trigger, provides a means for the probes to 
identify which messages are out of order or are still sitting in respective probe 
buffers. Old messages so discovered are then processed as if in real-time. 
Embodiments of the instant mvention described below complement the block 
diagrams and flowcharts of FIGS. 1-5 that describe various network architecture 
and their respective flmctions. 

[0026] The SS7 network carries a great deal of information and is critical 
to the operation of the phone system (see FIGS. 1-3). If the SS7 network is not 
functioning, the phone system cannot deliver phone calls. The actual parts of the 
SS7 network do not provide all the information required in network operations 
to manage and determine the health and state of the SS7 itself. 

[0027J Beyond the traditional SS7 network nodes, such as SSPs, STPs, 
and SCPs, element managers and probes are used to determine the health and 
state of the SS7 system. FIG. 4 is a block diagram of an example SS7 network 
employing several element managers, such as a 7View monitor and probes made 
by INRANGE Technologies Corp. of Moimt Laurel, NJ, and their respective and 
mutual relationship to the SS7 network. Each element manager is only attached 
to one or two probes, but each element manager can support more than sixteen 
probes. Sixteen probes is a limitation based on adding sixteen serial ports to a 
PC. However, in a TCP/IP embodiment, element managers can support more 
than 16 probes. 

[0028] The element managers or client terminals (not shown) attached 
thereto, may include protocol analysis decoding in a protocol analysis jframework 
to decode messages to text, filter messages based on selected criteria, and filter 
messages based on belonging to a particular session. This is shown and described 
in a related U.S. Provisional Patent Application filed September 7, 2000, entitled 
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"Protocol Analysis Framework" by B. Hannigan, the teachings of which are 
incorporated by reference herein in its entirety. 

[0029] In one embodiment, if the probes are using network terminal 
protocol time, then it is possible for the element managers and probes to 
synchronize to a common clock. For example, when using the common clock, 
the system can use the two least significant bits of the current second and a 14 bit 
value that stands for the number of 100/is periods that have elapsed in the cvirrent 
second. Ideally, the time stamp is small to minimize network traffic. 

[0030] Besides element managers communicating triggers, and other 
information to probes within their purview, the element managers can also 
broadcast the triggers to remote element managers. Once the remote element 
managers receive the trigger information, they can transmit triggers onto the 
normal local element manager broadcast mechanism for disseminating trigger 
information to aU subordinate probes. 

[0031] Some existing call trace schemes work in a multi-element manager 
configuration only when probes are wired in a manner such that trigger 
information does not have to be shared between element managers. The instant 
call trace scheme preferably employs a 100 millisecond guaranteed delivery time 
for the broadcast trigger information. 

[0032] A 100 millisecond guaranteed delivery time is possible with 
dedicated, high-speed voice lines to interconnect the element managers and the 
probes or other element managers. However, voice hnes are expensive since they 
are high revenue generating lines, whereas TCP/IP communications are 
inexpensive and, therefore, more agreeable to service providers for 
communication between and among the element managers and their respective 
probes. However, the 100 millisecond maximum delivery time cannot be 
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guaranteed in a TCP/IP environment, leaving some call trace systems vulnerable 
to transit delays causing loss of call tracing integrity. 

[0033] In order for a call trace to be successfiil in a multi-element 
manager configuration without regard to wiring or transit time delays greater than 
100 milliseconds, a modified call trace scheme can be employed according to the 
principles of the present invention, which also permits the use of the wildcard 
character 'X'. For call trace purposes, leading and trailing X's in a telephone 
number are discarded. All remaining X's represent exactly one digit. This is an 
example of a telephone number criterion. 

[0034] The inter-element manager, trigger broadcast system specifies that 
each trigger not only be broadcast to each probe under control of a given element 
manager, it is preferably also broadcast to each other element manager. Each 
element manager then broadcasts triggers to all probes that it controls (see Figs. 
4 and 5A-5C). Note that "800" numbers and niraibers entered using wildcards 
may be resolved to more than one telephone number, each of which is considered 
to be one of the four designated for the user. Therefore, "800" numbers and 
wildcards can diminish the total number of simultaneous call traces possible. 

[0035] The user must connect links in a particular way or call tracing will 
not v/ork. The instant call trace algorithm can overcome such hmitations in many 
instances. The tendency of errors occurs in catching extra frames, not missing 
extra fi-ames. The reason for this is found by going back in time and finding 
messages that were excluded. A delayed release complete (RLC) trigger excludes 
a frame from the trace and tells the element manager to drop that frame 
afterwards. RLC triggers receive a higher priority than lAM triggers. This is due, 
in part, because all hnks, which receive an lAM that does not match a phone 
number being traced, do not send that frame and broadcast a "remove 
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immediately" trigger. The lAM trigger broadcast can be delayed as much as two 
seconds without loss of frames. 

[0036] As used herein, articles such as "the", "an" and "a" can connote 
the singular or plural of the object, which follows. 
5 [0037] All documents referred to herein are incorporated herein by 

reference in their entireties. 

[0038] The many features and advantages of the invention are apparent 
from the detailed specification, and thus, it is intended by the appended claims to 
cover all such features and advantages of the invention which fall within the true 
10 spirits and scope of the invention. Further, since numerous modifications and 
variations will readily occur to those skilled in the art, it is not desired to limit the 
invention to the exact construction and operation illustrated and described, and 
accordingly, all suitable modifications and equivalents maybe resorted to, falling 
within the scope of the invention. 
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